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Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

!)□ Responsive to communication(s) filed on . 

2a)E3 This action is FINAL. 2b)D This action is non-final. 

3) Q Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1, 453 O.G. 213. 
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4) D Claim(s) 12-21 is/are pending in the application. 
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8) Q Claim(s) are subject to restriction and/or election requirement. 
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Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121 (d). 
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DETAILED ACTION 

CLAIMS PRESENTED 

Claims 12-21 are presented. 
All other claims are cancelled. 

Response to Arguments 

Applicant is thanked for the helpful presentation of Applicant's arguments. This 
has permitted a full and careful consideration. Applicant's arguments filed have been 
fully considered but they are not persuasive. 

Applicant argued that Phrack does not teach "temporarily storing certain 
subsequently received packets upon attainment of packet flow volume into a system 
reaching a certain level." See page 9 of Applicant's arguments filed in response to the 
rejections. This argument has led to a yet another careful study of Phrack. This is 
because the Office assumed Phrack to be discussing a typical situation of IP spoofing. 
In any normal defense against IP spoofing, such as discussed at page 8 of Phrack, 
packet filtering occurs. See page 8 of Phrack. In such situation, the router (as 
discussed by Phrack) is used to send away packets. This is done after some 
examination of origin of the packets. Thus, during such examination, "temporarily 
storing certain subsequently received packets upon attainment of packet flow volume 
into a system reaching a certain level" must occur. How can it not? How else is 
anything done otherwise? Only a temporary storage would put the packets in a 
situation where it can be examined without permitting intrusion. Furthermore, as IP 
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spoofing is usually part of a denial of service attack, some threshold handling must 
occur as part of the defense. Thus, the system must look for "reaching a certain level." 
In conclusion, Phrack has been re-studied and has been confirmed as not materially 
different from the usual prior art. 

For these reasons, the rejections over Phrack are sustained. Furthermore, as 
Phrack is cited as the usual prior art, Applicant is particularly requested to explain why 
the claimed invention is different from the usual prior art as assumed by those of 
ordinary skill in the art. Applicant has cited MPEP 2131 regarding anticipation. 
Underlying any rejection of anticipation is inherency. Otherwise, the only rejection 
permitted by anticipation would require ipsissimis verbis (exact vertabitim recitation) - 
which Applicant would recognize as absurdity. On this matter of inherency, the author 
of Phrack has (somewhat irreverently) noted that the Phrack article "assumes that you 
are not a moron." Thus, again, Applicant is respectfully requested to explain the actual 
(and not mere cosmetic) difference between the claimed invention and the prior art. 

CLAIM REJECTIONS 

Claim Rejections - 35 USC § 102 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

Claims 9-10, 12-18 are rejected under 35 U.S.C. 102(b) as being anticipated by 
Phrack (cited by Applicant, Phrack Magazine Volume Seven, Issue Forty-Eight, File 14 
of 18). 
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Regarding claim 9, Phrack teaches: A data network monitoring system 
comprising: at least one data sniffer; a temporary storage device; a processor for 
determining spoofing with respect to data passing through said system; and 
said processor further operative for diverting to said temporary storage device 
selected data entering said system, (page 8, i.e., router to help out) said selected data 
controlled in part by information obtained from said data sniffer and from a 
determination of spoofing (page 8, i.e., require authentication). 

Regarding claims 10, 12-18, see pages 8-9. These pages show that the details 
of keeping track of the network as in these claims are inherent to the situation noted in 
pages 8-9. 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 102 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was 
made. 

Claims 20-21 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Phrack. 

Phrack teaches as noted in the previous sections. 
Phrack does not teach the displaying as in these claims. 
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Nevertheless, it would have been obvious to have such displaying for the 
motivation of easier control by the system handling person. 

Thus, it would have been obvious to those of ordinary skill in the art to modify 
Phrack so as to teach the claimed inventions. 



Conclusion 

The art made of record and not relied upon is considered pertinent to applicant's 
disclosure. The art disclosed general background. 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Points of Contact 
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Any response to this action should be mailed to: 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

or faxed to: 

(571) 273-8300, (for formal communications intended for entry) 
Or: 

(571) 273-3836 (for informal or draft communications, please label "PROPOSED" or 
"DRAFT") 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David Jung whose telephone number is (571) 272-3836 
or Kambiz Zand whose telephone number is (272) 272-3811. 



David Jung 
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